REMARKS 

The application includes claims 1, 2, 4-6, 8-12, 14-20, 22, 24-28, 30-34, 36, 37, and 39. 
No claims are amended herein. No new matter is added. 

The application remains with claims 1, 2, 4-6, 8-12, 14-20, 22, 24-28, 30-34, 36, 37, and 
39 after entering this response. 

Claim Rejections - 35 U.S.C. § 112 

The Examiner rejected claims 1, 2, 4-6, 8-10, 22, 24-28, 30-33, 37, and 39 under 35 
U.S.C. § 112, first paragraph. 

The rejection is traversed. 

In rejecting claim 1, the Examiner alleged that "The Applicant's Specification does not 
describe these steps where the steganographic program is excluded, or the display of a list, 
developed based on a comparing step of programs modified by the steganographic program" 
(page 4, lines 4-6 of the Final Office Action). 

The Examiner's attention is directed to page 8, lines 8-10 of the specification which 
states that "The steganographic signature directory at 14 was obtained by assembling a series of 
steganographic programs... which implement steganography." Furthermore, "an important file 
in each of these steganographic programs was identified and chosen" (page 8, lines 16-17). 
Then, "Once the chosen files were identified, they were put into a specific steganographic 
directory containing no other files" (page 8, lines 30-31). As stated in the specification at page 6, 
lines 28-29, "The specific steganographic signature directory itself (see 14) is excluded from this 
procedure." 

Additionally, Applicant's specification states that "Because all files on a computer hard 
disk other than the signature directory and those on the exclusion list are compared with 
steganographic signatures, a user of the process 10 can be confident that all stegano graphically 
modified files will be identified for which there were steganographic signatures in the signature 
directory obtained at 14" (page 9, lines 8-12). Finally, "the procedure 24 to 46 iterates until it 
has either ended at 32 or the current directory has become the root search directory and all files 
in it have been checked for steganography. The results of checking at 42 are then reported at 52 
to a user of the process 1 0 " (page 7, lines 10-16). 
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Accordingly, withdrawal of the rejection of claims 1, 2, 4-6, 8-10, 22, 24-28, 30-33, 37, 
and 39 is respectfully requested. 

The Examiner rejected claims 1, 2, 4-6, 8-10, 22, 24-28, 30-33, 37, and 39 under 35 
U.S.C. § 112, second paragraph. 
The rejection is traversed. 

In rejecting claim 1, the Examiner alleges that "It is not clear from the context of the 
claim, which section of code is referred to in the last listed limitation above. As presented, it 
could apply to the steganographic program code, or the computer files from which the 
steganographic program is excluded" (page 5, last line, through page 6, line 2 of the Final Office 
Action). 

Applicant respectfully submits that there is no ambiguity in the recited claim features, but 
that rather the "partial sections of the software code" are specifically associated with the 
identified "computer files comprising software code, wherein the steganographic program is 
excluded from the identified computer files," as recited by claim 1 . Since the steganographic 
program is excluded from the identified computer files, the Examiner's alternative interpretation 
of the source code does not appear to logically follow. 

Accordingly, withdrawal of the rejection of claims 1, 2, 4-6, 8-10, 22, 24-28, 30-33, 37, 
and 39 is respectfully requested. 

Claim Rejections - 35 U.S.C. § 103 

The Examiner rejected claims 1, 2, 4-6, 8-12, 14-16, 18-20, 22, 24-26, 28, 30-34, 36, 37, 
and 39 under 35 U.S.C. § 103(a) over Cowie et al. (U.S. Patent Application Publication 
No. 2003/0023865) and variously in view of Feigen et al. (U.S. Patent Application Publication 
No. 2002/0138554), Vella (U.S. Patent Application Publication No. 2003/0212913), Atkinson 
(U.S. Patent No. 5,892,904), Pierre Richer: SANS/GIAC Practical Assignment for GSEC 
Certification Version 1.4b: Steganalysis: Detecting hidden information with computer forensic 
analysis, SANS Institute 2003 ("Richer"), and/or Charbonneau (U.S. Patent No. 7,526,654). 

The rejection is traversed. 

The Examiner acknowledged that Cowie fails to disclose locating a steganographic 
program comprising executable code that includes software calls that introduce steganographic 
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items into a computer file, identifying, with a processing device, computer files comprising 
software code, wherein the steganographic program is excluded from the identified computer 
files, and displaying, based on said comparing, a listing of which of the computer files comprise 
software code that has been modified by the steganographic program, as recited by claim 1 , and 
instead alleged that "Vella does teach such a feature ([0060] :program calls, fig. 3, [0064] a list of 
programs called by the steganographic executable is displayed)" (page 7, lines 12-13 of the Final 
Office Action). Applicant respectfully disagrees. 

Initially, Applicant remarks that Vella, as is the case for Cowie, also fails to disclose a 
steganographic program in the first instance. Instead Vella describes a "method for detecting a 
potentially malicious executable file" (Abstract). According to Vella, "A dynamic library is a 
file of code that can be called by other executable code, either an application program or another 
DLL, but which unlike an executable file cannot be directly run" (page 3, paragraph 0060). 

Applicant further remarks that while Vella describes that the DLL files are "called" by 
the executable file (page 3, paragraph 0061), the DLL file is not modified by the executable file. 
Accordingly, even assuming, arguendo, that Vella discloses displaying the DLL files or system 
calls at paragraph 0064, this nevertheless fails to disclose displaying, based on said comparing, a 
listing of which of the computer files comprise software code that has been modified by the 
steganographic program, as recited by claim 1. Rather, according to Vella, "The database 330 
contains only the names of DLL files etc. which it is known a priori are potentially malicious" 
(page 3, paragraph 0064). 

Assuming, arguendo, that the Examiner instead intended to identify the DLL files as the 
recited steganographic program, Applicant respectfully submits that Vella therefore fails to 
disclose that the steganographic program is excluded from the identified computer files, as 
recited by claim 1. Rather, Vella describes that "The name of the extracted dependent program 
code, e.g. 'wsock32.dll', is cross-checked, step 324, against a database 330 of known executable 
code or dynamic link library (DLL) file names representing known programs that could be used 
maliciously" (page 3, paragraph 0064). 
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Allowable Subject Matter 



The Examiner objected to claims 17 and 27 as being dependent upon a rejected base 
claim, but indicated that they would be allowable if rewritten in independent form, including all 
of the limitations of the base claim and any intervening claims. 

While Applicant agrees with the Examiner that claims 1 7 and 27 are allowable, Applicant 
respectfully declines to amend claims 17 and 27 on the basis that the independent claims 1 1 and 
31, upon which they depend, are themselves allowable as discussed above with respect to the 35 
U.S.C. § 103 rejection. 

Any statements made by the Examiner that are not addressed by the Applicant do not 
necessarily constitute agreement by the Applicant. In some cases, the Applicant may have 
argued the independent claims thereby obviating grounds for rejection of the dependent claims. 



For the foregoing reasons, the Applicant respectfully requests reconsideration and 
allowance of the present application. The Examiner is encouraged to telephone the undersigned 
at (503) 546-1812 if it appears that an interview would be helpful in advancing the case. 

Customer No. 73552 



CONCLUSION 



Respectfully submitted, 



STOLOWITZ FORD COWGER LLP 




Bryan D. Kirkpatrick 
Reg. No. 53,135 



STOLOWITZ FORD COWGER LLP 
621 SW Morrison Street, Suite 600 
Portland, OR 97205 
Telephone: 503-224-2170 
Fax: 503-224-2084 



Email: docket@stofoco.com 
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